Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    07/02/2025, 15:19

General

  • Target

    JaffaCakes118_b87d13b85aabc991fb6227395d6725fc.exe

  • Size

    1.2MB

  • MD5

    b87d13b85aabc991fb6227395d6725fc

  • SHA1

    855f118d7b70b9b6bd2faf3173a86852ae066da1

  • SHA256

    6477e9c098751549a6f0f8a30ee64f079aff6623893e78cdca72635b00b3f466

  • SHA512

    8245038ade88a92975369f87e0937144fa4224aa939c6e0a518c7cfd56de9c5f0bf8d32b4569275b43586e0ddb95c4c9198b52c86a571265276363c12af74f8d

  • SSDEEP

    24576:5U4oTNlCf+1k3uIh7uWeXoKnD0S79Sv9JkFEJ8SRZyMXkoaKbEhhHRsSq:5ULTbrmJVCXoKnD0SsoC86t0duEhh

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax family
  • Ardamax main executable 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b87d13b85aabc991fb6227395d6725fc.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b87d13b85aabc991fb6227395d6725fc.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Windows\SysWOW64\OKALOF\SAX.exe
      "C:\Windows\system32\OKALOF\SAX.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2940

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\OKALOF\AKV.exe

    Filesize

    536KB

    MD5

    b021d5d1954d5262b6f49883c504cd8b

    SHA1

    82377f1c748a3c65e6bc5ee292ab7fc0d302be02

    SHA256

    bb89a42fcb92aa04befad7108b2397012a784ba04b5b706e30eb9e9d4df919b8

    SHA512

    36421384207e2ed1c6ac9d40c862639ef2db1a7d2b43147ea4e115d2ec4cf141813f71074eb6e4155358051085a163160354b798328df12536f574730de5b24e

  • C:\Windows\SysWOW64\OKALOF\SAX.001

    Filesize

    60KB

    MD5

    a15c556f17d7db8287e023138942d5db

    SHA1

    880bf8ec944120830dc2e2e040e5996e4e0e6c83

    SHA256

    f3716810ab011a4cb7693d31b69cd540380ef2a067724e0d568070c8a558694e

    SHA512

    930339711e3d73e5af0778367a648c94411c20d23bf4c27ec5d72222e76b8902eb3fc0992d70cc4141600c19087159514246d42f1e762c98dad306f8e0bd99cd

  • C:\Windows\SysWOW64\OKALOF\SAX.002

    Filesize

    43KB

    MD5

    daabecdfba287a3333b60ae82211acd7

    SHA1

    e67b4c7bf0dd71ad47263a58bb60be4bce504b84

    SHA256

    12981c35adf6f00c7dddbc3ab23c04c30133cc5be107015dab9fd7ba4e8b4173

    SHA512

    937f551f959bd823292fe5983bbfb1c3a6dd86426a5da228dc7ddba38138c898599bc713d707b9d3463b20825cee0783d92c1c19019cd0328986a8aef5c1222f

  • C:\Windows\SysWOW64\OKALOF\SAX.004

    Filesize

    1KB

    MD5

    30d0e905c0a112e9ae46cd9d814b7e39

    SHA1

    adb6b555114709d07db4d920fe138b504240679d

    SHA256

    a103ead940649c7fe17f52500e33a592a4ebfc4b1cd01246799bfb06b7618809

    SHA512

    a11bcaf4009d7f2c7df6ca559ce881cfbb8873880e11001727f9baad2d4abcce56cb7866dab39c1ecdeb7295e6c374b2f7aa3fbb565044ecf11123255d310936

  • C:\Windows\SysWOW64\OKALOF\SAX.exe

    Filesize

    1.7MB

    MD5

    f3819a6cab8ae058254c4abb3844d87e

    SHA1

    0f8b1a74af87f1823ec0d76e21a8d54d55a53a8b

    SHA256

    3d656d1364b4b2382020f64990a2c630b7b9422ca7b7fe2c30646fda3303e6c9

    SHA512

    dfe9d342f3ad543fec8bd278e21ac5059b1c36ed3f735734e9b92d639cb25609f9307862ab2b35ea3e88713f4a652abe5863871225f915462c79d493ac5e1f57

  • memory/2940-15-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2940-17-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB